Critical· 9official fix available
CVE-2026-63089
WireGuard Easy versions up to 15.3.0 generate weak one‑time link tokens that can be brute‑forced. Attackers can recover a peer’s private key and preshared key, then impersonate that peer on the VPN. The flaw is critical because it allows full network takeover.
publishedJul 17, 2026
last modifiedJul 18, 2026
sourcesNVD
severity · cvss
9
critical · how bad it is
exploitation · epss
<1%
15th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
WireGuard Easy up to version 15.3.0.
02
Real-world impact
An attacker can obtain a peer’s PrivateKey and PresharedKey, then use them to connect to the VPN as that peer, gaining unrestricted access to all VPN traffic.
03
Why this severity
The CVSS score of 9 reflects the high impact of compromising a VPN peer, the low attack complexity, and the lack of authentication required.
04
What to do about it
official fix available
recommended steps
- 01Upgrade WireGuard Easy to a version that includes commit 66b292b or later.
- 02Restart the WireGuard service.
interim mitigations
- ›Block or restrict access to the /cnf/:oneTimeLink endpoint until the fix is applied.
NVD description
05
Timeline
- Jul 17, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsPresent
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →